Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,581 detections
Filters
Last updated
All Time
Detection languages
729
235
193
112
98
Contributors
323
311
275
169
73
Categories
20,437
11,828
5,871
5,150
4,864
1,581
Platforms
1,042
289
181
159
111
Products / Services
497
264
238
141
128
MITRE Techniques
852
757
502
416
312
CVEs
5
3
3
3
2
IDS Classtypes
211
4
3
3
2
IDS Protocols
219
7
3
1
1
Detects ClickFix-style social engineering attacks where users are lured into executing obfuscated commands via terminal copy-paste. The detection monitors for the sequential execution of remote file downloads (e.g., curl, PowerShell) followed immediately by shell history-clearing commands designed to obfuscate the malicious activity. This behavior is associated with macOS crypto-drainers and loaders.
Detects instances where common web server applications (e.g., Apache, Tomcat, IIS, Nginx) or Java runtime environments spawn suspicious child processes like command shells (cmd.exe, powershell.exe, sh, bash) or network utilities (wget, curl). This behavior often indicates exploitation of a web vulnerability, such as Remote Code Execution (RCE), allowing an adversary to execute commands or download further malicious payloads.
Detects the execution of the Windows Installer utility (msiexec.exe) where the command line references an Azure Blob Storage URL. This pattern is commonly used by adversaries to download and install malicious MSI packages directly from a remote storage location, bypassing local file creation.
Detects instances where Faronics Core related processes (FaronicsCore.exe, NCService.exe, ScriptRunner.exe) spawn common system utilities (curl.exe, mshta.exe, msiexec.exe) often used for downloading or executing payloads. This pattern may indicate the abuse of legitimate management software to facilitate unauthorized activity or second-stage payload delivery.
Detects the use of common command-line utilities (curl or wget) to download files to a temporary directory (/tmp/helper), initiated from within an interactive shell session (sh, zsh, bash). This pattern is commonly observed during the initial stages of post-exploitation, where threat actors download malicious scripts or tools to a staging directory before execution.
Detects the use of curl.exe to download an MSI file (update_ms.msi) from a remote HTTPS source into the ProgramData directory. This pattern is commonly observed in malware delivery campaigns attempting to deploy payloads in a location with lower access restrictions.
Detects the use of curl.exe to download a file named 'update_ms.msi' and save it to the 'C:\ProgramData\' directory. This activity is indicative of the msaRAT loader, a component often associated with Chaos ransomware, using the curl utility to drop malicious installer packages for execution.
This rule detects PowerShell processes performing file downloads using common commands (such as Invoke-WebRequest, BITS, or Certutil) and saving or targeting files within user-profile specific directories (AppData). This behavior is often indicative of an adversary staging malicious tools or payloads in a writeable user directory.
Detects users who have downloaded more than 50 files from cloud storage applications within a single hour, potentially indicating data exfiltration or mass data harvesting.
Detects the use of the BITSAdmin utility to create, add, resume, or complete download jobs, which may indicate an adversary attempting to download malicious files or tools onto a system.
Detects the execution of Windows processes where the file's web-origin metadata (Mark-of-the-Web) contains a referrer URL pointing to the public GitHub Desktop repository. This rule serves as a provenance and threat hunting signal to track the origin of binaries executed in the environment, identifying software potentially derived from this specific source repository.
Detects a non-Defender process writing mpam-fe*.exe to the Windows Internet Cache (INetCache).
BlueHammer downloads the WD signature update package directly using WinINet as a low-privileged user.
The [1].exe naming suffix is produced by Windows HTTP caching and is a reliable artifact of this download method.
BlueHammer downloads the WD signature update package directly using WinINet as a low-privileged user.
The [1].exe naming suffix is produced by Windows HTTP caching and is a reliable artifact of this download method.
Detects instances where Netskope Advanced Threat Protection (ATP) identifies a malicious file during a user-initiated upload or download operation.
Detects instances where Netskope Advanced Threat Protection (ATP) identifies a malicious file during a user-initiated upload or download operation.
This rule detects potentially malicious PowerShell activity characterized by the co-occurrence of file download indicators (such as Invoke-WebRequest, WebClient, or UserAgent strings) and file execution or staging commands (such as IEX, Expand-Archive, or Copy-Item) within the same command line. It is designed to identify ingress tool transfer and command-line execution patterns often associated with post-exploitation or malware staging, while reducing noise by requiring both download and operational intent.
This rule detects potentially malicious activity leveraging the Windows Certutil utility for downloading, decoding, and executing files or payloads. It monitors process command line arguments to identify common download flags, hex/base64 decoding operations, evasion techniques, and interaction with high-risk file types or directories. The rule calculates a severity score based on the combination of these behaviors, such as downloading and decoding a file, or executing content from a temporary directory.
Detects bulk SharePoint/M365 file access or download either from a known UNC6671 exfiltration IP, or via a scripting-library user agent that is new for the user and exceeds a volume threshold within a short session window.
Detects potentially unauthorized or suspicious file activities such as bulk downloads, external file sharing, or CASB policy violations monitored by Zscaler ZIA, which may indicate data exfiltration or policy non-compliance.
Detects users who have downloaded more than 50 files from cloud storage applications within a single hour, potentially indicating data exfiltration or mass data harvesting.
Detects the execution of the Bun JavaScript runtime by npm or node.js during lifecycle tasks (preinstall, postinstall, etc.). This behavior is highly indicative of the ChainDrop/Shai-Hulud supply chain worm, which uses npm lifecycle scripts to download and execute a second-stage payload using the Bun runtime.
Detects instances where a single user account performs a large volume of file downloads (50 or more unique files) within a 30-minute window from Office 365 services. This behavior may indicate unauthorized data exfiltration or mass collection of sensitive information.
Page 33 of 76